@mesh-tech/mesh-cli 0.20.1 → 0.20.3

package/README.md

@@ -78,11 +78,12 @@ runs it for you.
 mesh init
 ```
 
-Run it in your `<tenant>-mesh-apps` clone (an empty one is fine). The wizard
-asks which tenant this repo belongs to and where it runs — *local only*
-(`mesh start` / `mesh dev`) or *a deployed Mesh platform* — then checks your
-registry access (signing you in if step 2 was skipped), bootstraps the repo
-layout, installs the agent skills, and prints a summary with the next command.
+Run it in your `<tenant>-mesh-apps` clone, or in a brand-new empty folder — the
+wizard runs `git init` there for you. It asks which tenant this repo belongs to
+and where it runs — *local only* (`mesh start` / `mesh dev`) or *a deployed Mesh
+platform* — then checks your registry access (signing you in if step 2 was
+skipped), bootstraps the repo layout, installs the agent skills, and prints a
+summary with the next command.
 Every answer has a flag, so a headless run is one line:
 
 ```bash

package/dist/bin/mesh.d.ts

@@ -1,14 +1,2 @@
 #!/usr/bin/env node
-/**
- * mesh - CLI for Mesh Lab development utilities
- *
- * The command tree itself lives in `src/program.ts` so `mesh docs
- * cli-reference` can walk it without running the CLI. This file is only the
- * runner: resolve the version, build the program, parse.
- *
- * For the command list, run `mesh --help` or read the generated reference
- * (`docs/portal/generated/cli-reference.md`) — a hand-maintained list in this
- * header is exactly the kind of prose that goes stale.
- */
 export {};
-//# sourceMappingURL=mesh.d.ts.map

package/dist/bin/mesh.js

@@ -2005,7 +2005,7 @@ function buildSquatterError(tenant, squatted, detail) {
     `    mesh vpn -t ${tenant} tunnel down --stop    # tear down mesh-owned runners + daemon`,
     `    lsof -nP -iTCP:${first} -sTCP:LISTEN        # identify what still holds the port`,
     `  then stop that process and re-run.`,
-    // Port blocks are a 63-bucket hash (MESH-2375), so a DIFFERENT tenant's
+    // Port blocks are a 63-bucket hash, so a DIFFERENT tenant's
     // runner can collide onto this block — in which case the `down` above is a
     // no-op and only lsof identifies the real owner.
     `  (If lsof names another mesh runner, it belongs to a different tenant \u2014 tear that one down instead.)`
@@ -2373,13 +2373,13 @@ async function ensureForwarders(state) {
   const runnerAlive = prior?.managed === "launchd" ? fs8.existsSync(launchAgentPath(state.tenant)) : pidAlive(prior?.supervisorPid);
   if (prior && runnerAlive && tunnelTargetsEqual(prior.tunnels, state.tunnels) && // A prior supervisor spawned for a DIFFERENT SOCKS port still binds the same
   // local ports but dials a dead upstream — reusing it silently strands every
-  // tunnel (MESH-2169). The port must match, and the runner must PROVE it is
+  // tunnel. The port must match, and the runner must PROVE it is
   // ours via the ownership handshake (liveness ≠ ownership — a port answering
   // a dial can be another session's SSM tunnel or an orphaned runner, #2991).
   // Poll briefly rather than sample once: `ports-not-listening` during the
   // runner's own rebind window and `no-control-answer` under load are
   // transient, and a single miss here would tear down a healthy runner SHARED
-  // by every concurrent session on the tenant (MESH-2014). This branch is
+  // by every concurrent session on the tenant. This branch is
   // only reached when the runner is alive with matching targets, so the
   // retry costs nothing on cold-start or genuinely-dead paths.
   prior.socksPort === state.socksPort && (await awaitOwnership(state.tenant, expected, 1e3)).ok) {
@@ -8387,7 +8387,7 @@ async function probeTunnelHealth(tunnels) {
       // sees exactly what a dependent service would. Use the connection-HOLDS
       // probe, not a bare accept: a forwarder binds its local port even when its
       // upstream leg is dead (a dropped SSM session, or a Tailscale SOCKS bridge
-      // dialing a stale port — MESH-2169), so "port accepts" would report a dead
+      // dialing a stale port), so "port accepts" would report a dead
       // tunnel as healthy. Holding briefly catches the accept-then-close teardown.
       reachable: await probeConnectionHolds(
         tun.host === "localhost" ? "127.0.0.1" : tun.host,
@@ -8945,7 +8945,7 @@ async function startServices(sessionName, appRoot, devOutput, headless, awsEnv,
       // wins over the tmux session env, the placeholder would clobber the
       // real token injected above — silently 401ing tenant-scoped Hub views.
       ...devUserVars,
-      // Per-worktree Temporal task-queue isolation (MESH-2013 Slice 2): agent
+      // Per-worktree Temporal task-queue isolation: agent
       // workers/apps append this to their task-queue names so concurrent
       // worktrees don't steal each other's workflow tasks. Empty on the primary
       // checkout → omitted → unchanged historical behavior.
@@ -9597,7 +9597,7 @@ function registerDevCommand(program2) {
     }
     if (options.mock || options.externals) {
       logWarn(
-        "--externals/--mock is local-mode only for now (tethered dev outputs do not carry external declarations yet \u2014 MESH-1885). Continuing without them."
+        "--externals/--mock is local-mode only for now (tethered dev outputs do not carry external declarations yet). Continuing without them."
       );
     }
     const stack = detectStack(appRoot, resolveStackOption(options));
@@ -12272,6 +12272,7 @@ __export(create_app_exports, {
   PLATFORM_MONOREPO_NAME: () => PLATFORM_MONOREPO_NAME,
   bootstrapAppsRepo: () => bootstrapAppsRepo,
   copyTemplate: () => copyTemplate,
+  describeNoAppsHome: () => describeNoAppsHome,
   ensureRegistryAccess: () => ensureRegistryAccess,
   ensureWorkspaceGlobs: () => ensureWorkspaceGlobs,
   generateComposableApp: () => generateComposableApp,
@@ -12461,6 +12462,18 @@ function parsePrimitives(input2) {
   }
   return selected;
 }
+function describeNoAppsHome(cwd, tenant, baseDir, test) {
+  if (test || isInsidePlatformMonorepo(cwd)) {
+    return {
+      message: `Tenant directory not found: ${baseDir}/${tenant}/`,
+      hint: "Create the tenant directory first, or run from within it."
+    };
+  }
+  return {
+    message: `This directory is not a Mesh apps repo \u2014 no apps/ here${fs23.existsSync(path25.join(cwd, ".git")) ? "" : " and it is not a git repo"}.`,
+    hint: `Run: mesh init   (turns this folder into your ${tenant}-mesh-apps repo), or cd into that repo and re-run mesh create-app.`
+  };
+}
 function resolveAppDir(cwd, tenant, name, test) {
   const baseDir = test ? "tests/tenants" : "tenants";
   const possiblePaths = test ? [path25.join(cwd, baseDir, tenant, "apps")] : [
@@ -12472,8 +12485,9 @@ function resolveAppDir(cwd, tenant, name, test) {
   if (!appsDir) {
     appsDir = path25.join(cwd, baseDir, tenant, "apps");
     if (!fs23.existsSync(path25.join(cwd, baseDir, tenant))) {
-      logError(`Tenant directory not found: ${baseDir}/${tenant}/`);
-      logInfo("Create the tenant directory first, or run from within it.");
+      const { message, hint } = describeNoAppsHome(cwd, tenant, baseDir, test);
+      logError(message);
+      logInfo(hint);
       process.exit(1);
     }
     if (!fs23.existsSync(appsDir)) {
@@ -13514,7 +13528,7 @@ function formatStaleDepsError(mismatches) {
   lines.push(
     "",
     "  A stale node_modules makes pulumi evaluate OLD component code and can plan to",
-    "  DELETE resources the current code would keep (MESH-2266). Fix:",
+    "  DELETE resources the current code would keep. Fix:",
     "",
     "      pnpm install",
     "",
@@ -15793,7 +15807,7 @@ function assembleHubEnv(session, sessionEnv, opts) {
   }
   if (!forwarded.DEV_USER_TOKEN_URL) {
     notes.push(
-      "Dev session predates the per-session token-server (MESH-2039) \u2014 starting a dedicated one so tokens stay fresh past ~1h."
+      "Dev session predates the per-session token-server \u2014 starting a dedicated one so tokens stay fresh past ~1h."
     );
   }
   const temporalAddress = sessionEnv.TEMPORAL_ADDRESS ?? (session.state.devOutput.tunnels["temporal"] ? tunnelClientAddress(session.state.devOutput.tunnels["temporal"]) : (
@@ -16300,7 +16314,7 @@ function resolvePublisherRoleArn({
   const resolved = roleArnFlag || ssmArn;
   if (!resolved) {
     throw new Error(
-      "No publisher role: pass --role or ensure the registry stack exported publisherRoleArn (MESH-2168)."
+      "No publisher role: pass --role or ensure the registry stack exported publisherRoleArn."
     );
   }
   return resolved;
@@ -16887,6 +16901,7 @@ var init_registry = __esm({
 // libs/mesh-cli/src/commands/init/wizard.ts
 var wizard_exports = {};
 __export(wizard_exports, {
+  INIT_REPO_FIX: () => INIT_REPO_FIX,
   INTERRUPTED_EXIT_CODE: () => INTERRUPTED_EXIT_CODE,
   NO_SESSION_NO_TTY_MESSAGE: () => NO_SESSION_NO_TTY_MESSAGE,
   TENANT_REQUIRED_MESSAGE: () => TENANT_REQUIRED_MESSAGE,
@@ -16895,6 +16910,7 @@ __export(wizard_exports, {
   describeMode: () => describeMode,
   registryStep: () => registryStep,
   renderWizardSummary: () => renderWizardSummary,
+  repoStep: () => repoStep,
   resolveAnswers: () => resolveAnswers,
   runInitWizard: () => runInitWizard,
   runWizardSteps: () => runWizardSteps,
@@ -16904,12 +16920,15 @@ __export(wizard_exports, {
 });
 import * as fs30 from "fs";
 import * as path37 from "path";
+import { execFileSync as execFileSync25 } from "child_process";
 import chalk4 from "chalk";
 function wizardExitCode(steps) {
   return steps.some((s) => s.status === "fail") ? 1 : 0;
 }
-function wizardNextCommands(mode) {
-  return mode === "local" ? ["mesh create-app"] : ["mesh create-app", "mesh deploy up   # from the app directory, once it exists"];
+function wizardNextCommands(mode, steps = []) {
+  const repo = steps.find((s) => s.name === STEP_LABELS.repo);
+  const first = repo && repo.status !== "pass" && repo.fix ? repo.fix : "mesh create-app";
+  return mode === "local" ? [first] : [first, "mesh deploy up   # from the app directory, once it exists"];
 }
 function stepBlocks(result) {
   return result.status === "fail" && result.blocking !== false;
@@ -16958,12 +16977,18 @@ function classifyRepo(cwd) {
   if (shouldBootstrapAppsRepo(cwd)) return { kind: "empty-apps-repo", root: cwd };
   const root = resolveTargetRoot(cwd);
   const inRepo = fs30.existsSync(path37.join(root, ".git"));
-  if (!inRepo) return { kind: "no-repo", root };
+  if (!inRepo) {
+    const hasContent = fs30.readdirSync(cwd).some((entry) => !entry.startsWith("."));
+    return { kind: hasContent ? "no-repo" : "empty-dir", root: cwd };
+  }
   const hasWorkspace = fs30.existsSync(path37.join(root, "pnpm-workspace.yaml")) || fs30.existsSync(path37.join(root, "pnpm-lock.yaml"));
   const hasApps = fs30.existsSync(path37.join(root, "apps")) || fs30.existsSync(path37.join(root, "tenants"));
   if (hasWorkspace || hasApps) return { kind: "apps-repo", root };
   return { kind: "other-repo", root };
 }
+function gitInit(dir) {
+  execFileSync25("git", ["init", "-q"], { cwd: dir, stdio: ["ignore", "ignore", "pipe"] });
+}
 async function runWizardSteps(ctx, steps) {
   const results = [];
   for (const step of steps) {
@@ -17055,7 +17080,7 @@ async function runInitWizard(opts, deps = {}) {
       const written = writeMeshJson(root, { tenant, platform: mode === "local" ? "local" : mode.platform });
       logInfo(`Recorded tenant + mode in ${written}`);
     }
-    const outcome = { tenant, mode, steps, next: wizardNextCommands(mode) };
+    const outcome = { tenant, mode, steps, next: wizardNextCommands(mode, steps) };
     const code = wizardExitCode(steps);
     if (opts.json) {
       console.log = origLog;
@@ -17077,7 +17102,7 @@ async function runInitWizard(opts, deps = {}) {
     console.log = origLog;
   }
 }
-var NO_SESSION_NO_TTY_MESSAGE, TENANT_REQUIRED_MESSAGE, INTERRUPTED_EXIT_CODE, STEP_LABELS, registryStep, platformStep, repoStep, skillsStep, WIZARD_STEPS;
+var NO_SESSION_NO_TTY_MESSAGE, TENANT_REQUIRED_MESSAGE, INTERRUPTED_EXIT_CODE, STEP_LABELS, registryStep, platformStep, INIT_REPO_FIX, repoStep, skillsStep, WIZARD_STEPS;
 var init_wizard = __esm({
   "libs/mesh-cli/src/commands/init/wizard.ts"() {
     "use strict";
@@ -17181,6 +17206,7 @@ var init_wizard = __esm({
         };
       }
     };
+    INIT_REPO_FIX = "git init && mesh init";
     repoStep = {
       name: "repo",
       async run(ctx) {
@@ -17190,11 +17216,34 @@ var init_wizard = __esm({
         switch (kind) {
           case "platform-monorepo":
             return { name, status: "skip", detail: "inside mesh-platform \u2014 apps here link workspace packages; nothing to set up" };
+          case "empty-dir": {
+            const go = ctx.yes || !ctx.interactive ? true : await ctx.prompts.confirm({
+              message: `This folder is not a git repo \u2014 initialize ${root} as your ${ctx.tenant}-mesh-apps repo here?`,
+              default: true
+            });
+            if (!go) {
+              return { name, status: "skip", detail: "folder left as is", fix: `cd <your ${ctx.tenant}-mesh-apps clone> && mesh init` };
+            }
+            try {
+              (ctx.seams?.gitInit ?? gitInit)(root);
+            } catch (err) {
+              const why = err instanceof Error && "stderr" in err && err.stderr ? String(err.stderr).trim() : "";
+              return {
+                name,
+                status: "fail",
+                detail: `git init failed \u2014 is git installed and ${root} writable?${why ? ` (${why})` : ""}`,
+                fix: INIT_REPO_FIX
+              };
+            }
+            const created = bootstrapAppsRepo(root, ctx.tenant);
+            return { name, status: "pass", detail: `initialized a git repo and bootstrapped the apps repo: ${created.join(", ")}` };
+          }
           case "no-repo":
             return {
               name,
               status: "skip",
-              detail: `not in a git repo \u2014 clone (or git init) your ${ctx.tenant}-mesh-apps repo and re-run mesh init there`
+              detail: `not in a git repo, and this folder already holds files \u2014 clone (or git init) your ${ctx.tenant}-mesh-apps repo and re-run mesh init there`,
+              fix: INIT_REPO_FIX
             };
           case "other-repo":
             return {
@@ -17533,19 +17582,19 @@ var init_init = __esm({
 });
 
 // libs/mesh-cli/src/commands/install-shim.ts
-import { execFileSync as execFileSync25 } from "child_process";
+import { execFileSync as execFileSync26 } from "child_process";
 import * as fs32 from "fs";
 import * as os10 from "os";
 import * as path39 from "path";
 function shimScript() {
   return `#!/bin/sh
-# mesh \u2014 canonical launcher shim (installed by \`mesh install-shim\`, MESH-2261).
+# mesh \u2014 canonical launcher shim (installed by \`mesh install-shim\`).
 # Walks up from the current directory to the nearest workspace mesh CLI and runs
 # it. That resolves to bin/mesh.mjs, which runs the CLI from TypeScript source \u2014
 # so this always runs the LOCAL source of whatever worktree/app you are in, with
 # no build step. Nothing here is version-pinned; do not edit by hand.
 #
-# Outside a workspace it hands off to a globally installed mesh CLI (MESH-2869).
+# Outside a workspace it hands off to a globally installed mesh CLI.
 # Without that hand-off the shim shadows \`npm i -g @mesh-tech/mesh-cli\` on the
 # PATH and \`mesh login\` is unreachable from the home directory \u2014 which is the
 # very first thing a new developer runs.
@@ -17646,7 +17695,7 @@ function registerInstallShimCommand(program2) {
     let status = 0;
     let ok = true;
     try {
-      stdout = execFileSync25(target, ["--help"], {
+      stdout = execFileSync26(target, ["--help"], {
         cwd: process.cwd(),
         encoding: "utf8",
         stdio: ["ignore", "pipe", "pipe"]
@@ -17693,7 +17742,7 @@ var init_install_shim = __esm({
 });
 
 // libs/mesh-cli/src/commands/local/hub-local.ts
-import { execFile as execFile3, execFileSync as execFileSync26 } from "child_process";
+import { execFile as execFile3, execFileSync as execFileSync27 } from "child_process";
 import * as fs33 from "fs";
 import * as os11 from "os";
 import * as path40 from "path";
@@ -17713,7 +17762,7 @@ function npmrcPath() {
 }
 function imageExists(tag) {
   try {
-    execFileSync26("docker", ["image", "inspect", tag], { stdio: ["ignore", "pipe", "pipe"] });
+    execFileSync27("docker", ["image", "inspect", tag], { stdio: ["ignore", "pipe", "pipe"] });
     return true;
   } catch {
     return false;
@@ -17723,7 +17772,7 @@ function ensureHubAuthImage() {
   if (imageExists(HUB_AUTH_IMAGE)) return;
   logInfo(`Building ${HUB_AUTH_IMAGE} (Hub auth proxy)\u2026`);
   const hubStackDir = path40.join(findPackageRoot(), "stack", "hub");
-  execFileSync26(
+  execFileSync27(
     "docker",
     ["build", "-f", path40.join(hubStackDir, "Dockerfile.auth"), "-t", HUB_AUTH_IMAGE, hubStackDir],
     { stdio: ["ignore", "inherit", "inherit"], env: { ...process.env, DOCKER_BUILDKIT: "1" } }
@@ -17737,7 +17786,7 @@ function hasRegistryAuth() {
 function localHubVersion() {
   const versions = HUB_IMAGES.map((name) => {
     try {
-      const out = execFileSync26("docker", ["images", name, "--format", "{{.Tag}}"], {
+      const out = execFileSync27("docker", ["images", name, "--format", "{{.Tag}}"], {
         encoding: "utf-8",
         stdio: ["ignore", "pipe", "pipe"]
       });
@@ -17816,7 +17865,7 @@ async function ensureHubImages() {
   const context = path40.join(cacheDir(), `context-${version}`);
   fs33.rmSync(context, { recursive: true, force: true });
   fs33.mkdirSync(context, { recursive: true });
-  execFileSync26("tar", ["-xzf", tarball, "-C", context, "--strip-components", "1"], {
+  execFileSync27("tar", ["-xzf", tarball, "-C", context, "--strip-components", "1"], {
     stdio: ["ignore", "pipe", "pipe"]
   });
   const hubStackDir = path40.join(findPackageRoot(), "stack", "hub");
@@ -17827,7 +17876,7 @@ async function ensureHubImages() {
     const tag = `${name}:${version}`;
     if (imageExists(tag)) continue;
     logInfo(`Building ${tag} from the published tarball\u2026`);
-    execFileSync26(
+    execFileSync27(
       "docker",
       [
         "build",
@@ -17857,7 +17906,7 @@ function readHubCompiledAuthz(version) {
     if (!tarball || !fs33.existsSync(path40.join(cacheDir(), tarball))) return null;
     fs33.mkdirSync(context, { recursive: true });
     try {
-      execFileSync26(
+      execFileSync27(
         "tar",
         ["-xzf", path40.join(cacheDir(), tarball), "-C", context, "--strip-components", "1", `package/${HUB_COMPILED_AUTHZ_REL}`],
         { stdio: ["ignore", "pipe", "pipe"] }
@@ -17951,7 +18000,7 @@ async function buildHubImagesFromSource(repoRoot2) {
   await execFileAsync2("pnpm", ["pack", "--pack-destination", context], { cwd: hubDir, maxBuffer: 64 * 1024 * 1024 });
   const tarball = fs33.readdirSync(context).find((f) => f.endsWith(".tgz"));
   if (!tarball) throw new MeshCliError("pnpm pack produced no tarball for apps/hub");
-  execFileSync26("tar", ["-xzf", path40.join(context, tarball), "-C", context, "--strip-components", "1"], {
+  execFileSync27("tar", ["-xzf", path40.join(context, tarball), "-C", context, "--strip-components", "1"], {
     stdio: ["ignore", "pipe", "pipe"]
   });
   const rewritten = normalizeHubManifests(context, readWorkspaceCatalog(repoRoot2));
@@ -17963,7 +18012,7 @@ async function buildHubImagesFromSource(repoRoot2) {
   ]) {
     const tag = `${name}:${version}`;
     logInfo(`Building ${tag} from source\u2026`);
-    execFileSync26(
+    execFileSync27(
       "docker",
       ["build", "-f", path40.join(hubStackDir, dockerfile), "-t", tag, "--secret", `id=npmrc,src=${npmrc}`, context],
       { stdio: ["ignore", "inherit", "inherit"], env: { ...process.env, DOCKER_BUILDKIT: "1" } }
@@ -19595,7 +19644,7 @@ var init_site = __esm({
 });
 
 // libs/mesh-cli/src/commands/stack.ts
-import { execFileSync as execFileSync27 } from "child_process";
+import { execFileSync as execFileSync28 } from "child_process";
 import * as path42 from "path";
 import * as fs35 from "fs";
 import { parse as parseYaml5 } from "yaml";
@@ -19688,7 +19737,7 @@ function readBaseConfigFromYaml(appRoot, stack) {
 }
 function getGitHubUsername() {
   try {
-    const result = execFileSync27("gh", ["api", "user", "--jq", ".login"], {
+    const result = execFileSync28("gh", ["api", "user", "--jq", ".login"], {
       encoding: "utf-8",
       stdio: ["pipe", "pipe", "pipe"]
     });
@@ -19697,7 +19746,7 @@ function getGitHubUsername() {
   } catch {
   }
   try {
-    const result = execFileSync27("git", ["config", "user.email"], {
+    const result = execFileSync28("git", ["config", "user.email"], {
       encoding: "utf-8",
       stdio: ["pipe", "pipe", "pipe"]
     });
@@ -19719,7 +19768,7 @@ function registerStackCommand(program2) {
     false
   ).option(
     "--parent-zone <zone>",
-    "With --platform: parent DNS zone for the env zone (mesh:dns.public.parentZone) \u2014 platform hostnames become {sub}.{env}.{parentZone} (e.g. hub.dmb-dev.mesh.meshtech.io), so personal stacks never collide on DNS"
+    "With --platform: parent DNS zone for the env zone (mesh:dns.public.parentZone) \u2014 platform hostnames become {sub}.{env}.{parentZone} (e.g. hub.<env>.<parentZone>), so personal stacks never collide on DNS"
   ).action(async (opts) => {
     const appRoot = findAppRoot(process.cwd());
     if (!appRoot) {
@@ -19783,7 +19832,7 @@ Specify which to base on: mesh stack init --from <stack>`
     if (!opts.adopt) {
       let existing = [];
       try {
-        const raw = execFileSync27("pulumi", ["stack", "ls", "--json"], {
+        const raw = execFileSync28("pulumi", ["stack", "ls", "--json"], {
           cwd: appRoot,
           encoding: "utf-8",
           env: pulumiEnv,
@@ -19807,7 +19856,7 @@ Specify which to base on: mesh stack init --from <stack>`
       logInfo(`Using KMS secrets provider: ${secretsProvider}`);
     }
     try {
-      execFileSync27("pulumi", initArgs, {
+      execFileSync28("pulumi", initArgs, {
         cwd: appRoot,
         env: pulumiEnv,
         stdio: "inherit"
@@ -19824,7 +19873,7 @@ Specify which to base on: mesh stack init --from <stack>`
       }
     }
     try {
-      execFileSync27("pulumi", ["stack", "select", newStack], {
+      execFileSync28("pulumi", ["stack", "select", newStack], {
         cwd: appRoot,
         env: pulumiEnv,
         stdio: ["pipe", "pipe", "pipe"]
@@ -19834,7 +19883,7 @@ Specify which to base on: mesh stack init --from <stack>`
     if (!configExists) {
       let baseConfig = {};
       try {
-        const raw = execFileSync27(
+        const raw = execFileSync28(
           "pulumi",
           ["config", "--json", "--stack", baseStack],
           { cwd: appRoot, env: pulumiEnv, encoding: "utf-8", stdio: ["pipe", "pipe", "pipe"] }
@@ -19852,19 +19901,19 @@ Specify which to base on: mesh stack init --from <stack>`
         if (key === "mesh:deploy") continue;
         try {
           if (entry.objectValue !== void 0) {
-            execFileSync27(
+            execFileSync28(
               "pulumi",
               ["config", "set", key, JSON.stringify(entry.objectValue)],
               { cwd: appRoot, env: pulumiEnv, stdio: ["pipe", "pipe", "pipe"] }
             );
           } else if (entry.value === "true" || entry.value === "false") {
-            execFileSync27(
+            execFileSync28(
               "pulumi",
               ["config", "set", "--type", "bool", key, entry.value],
               { cwd: appRoot, env: pulumiEnv, stdio: ["pipe", "pipe", "pipe"] }
             );
           } else {
-            execFileSync27(
+            execFileSync28(
               "pulumi",
               ["config", "set", key, entry.value],
               { cwd: appRoot, env: pulumiEnv, stdio: ["pipe", "pipe", "pipe"] }
@@ -19877,7 +19926,7 @@ Specify which to base on: mesh stack init --from <stack>`
         const baseEnv = readConfigBlockKey(appRoot, baseStack, "mesh:coreEnv") ?? (baseTenant && baseStack.startsWith(`${baseTenant}-`) ? baseStack.slice(baseTenant.length + 1) : baseStack);
         const setCfg = (args) => {
           try {
-            execFileSync27("pulumi", ["config", "set", ...args], {
+            execFileSync28("pulumi", ["config", "set", ...args], {
               cwd: appRoot,
               env: pulumiEnv,
               stdio: ["pipe", "pipe", "pipe"]
@@ -19926,7 +19975,7 @@ Specify which to base on: mesh stack init --from <stack>`
           `Configured Pulumi.${newStack}.yaml (personal platform env on core '${baseEnv}'${opts.parentZone ? `, DNS zone ${newStack.startsWith(`${baseTenant}-`) ? newStack.slice(baseTenant.length + 1) : newStack}.${opts.parentZone}` : ""})`
         );
       } else {
-        execFileSync27("pulumi", ["config", "set", "--type", "bool", "mesh:deploy", "false"], {
+        execFileSync28("pulumi", ["config", "set", "--type", "bool", "mesh:deploy", "false"], {
           cwd: appRoot,
           env: pulumiEnv,
           stdio: ["pipe", "pipe", "pipe"]
@@ -19956,7 +20005,7 @@ Specify which to base on: mesh stack init --from <stack>`
     const args = ["stack", "rm", name];
     if (opts.yes) args.push("--yes");
     try {
-      execFileSync27("pulumi", args, { cwd: appRoot, env: pulumiEnv, stdio: "inherit" });
+      execFileSync28("pulumi", args, { cwd: appRoot, env: pulumiEnv, stdio: "inherit" });
       logSuccess(`Removed stack ${name}`);
     } catch (err) {
       process.exit(err.status ?? 1);
@@ -20168,12 +20217,12 @@ var init_recover_conversation = __esm({
 });
 
 // libs/mesh-cli/src/utils/temporal-codec.ts
-import { execFileSync as execFileSync28 } from "child_process";
+import { execFileSync as execFileSync29 } from "child_process";
 import { webcrypto as crypto4 } from "node:crypto";
 function resolveTemporalEncodingKeyFromK8s(namespace) {
   const secretName = `${namespace}-temporal-encoding-key`;
   try {
-    const b64 = execFileSync28(
+    const b64 = execFileSync29(
       "kubectl",
       [
         "get",
@@ -23513,7 +23562,7 @@ var init_src4 = __esm({
 import * as fs38 from "fs";
 import * as path45 from "path";
 import { createRequire as createRequire2 } from "module";
-import { execFileSync as execFileSync29 } from "child_process";
+import { execFileSync as execFileSync30 } from "child_process";
 function resolveExtractorPath() {
   try {
     const require2 = createRequire2(import.meta.url);
@@ -23568,7 +23617,7 @@ for (const file of files) {
 process.stdout.write(JSON.stringify(results));
 `;
   try {
-    const result = execFileSync29("npx", ["tsx", "--eval", script], {
+    const result = execFileSync30("npx", ["tsx", "--eval", script], {
       encoding: "utf-8",
       stdio: ["pipe", "pipe", "inherit"],
       maxBuffer: 10 * 1024 * 1024
@@ -23610,7 +23659,7 @@ for (const file of files) {
 process.stdout.write(JSON.stringify(results));
 `;
   try {
-    const result = execFileSync29("npx", ["tsx", "--eval", script], {
+    const result = execFileSync30("npx", ["tsx", "--eval", script], {
       encoding: "utf-8",
       stdio: ["pipe", "pipe", "inherit"],
       maxBuffer: 10 * 1024 * 1024
@@ -23665,7 +23714,7 @@ for (const file of files) {
 process.stdout.write(JSON.stringify(results));
 `;
   try {
-    const result = execFileSync29("npx", ["tsx", "--eval", script], {
+    const result = execFileSync30("npx", ["tsx", "--eval", script], {
       encoding: "utf-8",
       stdio: ["pipe", "pipe", "inherit"],
       maxBuffer: 10 * 1024 * 1024